| Message ID | 20190820145208.29115-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | f51e4d026cc762ff2d47d6107658dbff42ba5ea8 |
| Headers | show |
Am 20.08.19 um 16:52 schrieb Michael Niedermayer: > There seems to be no limit in the specification and upto 64k could be stored > 512 is choosen as limit as thats the maximum in a conformance sample > > An alternative to this patch would be a max_channels variable > > Fixes: OOM > Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/alsdec.c | 5 +++++ > 1 file changed, 5 insertions(+) Patch 1 & 2 LGTM. Will send a patch for FATE soonish after commit. -Thilo
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 36ee164ee4..11bbd38f58 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -348,6 +348,11 @@ static av_cold int read_specific_config(ALSDecContext *ctx) if (als_id != MKBETAG('A','L','S','\0')) return AVERROR_INVALIDDATA; + if (avctx->channels > FF_SANE_NB_CHANNELS) { + avpriv_request_sample(avctx, "Huge number of channels\n"); + return AVERROR_PATCHWELCOME; + } + ctx->cur_frame_length = sconf->frame_length; // read channel config
There seems to be no limit in the specification and upto 64k could be stored 512 is choosen as limit as thats the maximum in a conformance sample An alternative to this patch would be a max_channels variable Fixes: OOM Fixes: 16200/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5764788793114624 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Suggested-by: Thilo Borgmann <thilo.borgmann@mail.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/alsdec.c | 5 +++++ 1 file changed, 5 insertions(+)